What is the CVSS score of CVE-2026-25996?

CVE-2026-25996 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Kubernetes are affected by CVE-2026-25996?

Inspektor Gadget, a Kubernetes monitoring and inspection tool, contains a critical vulnerability (CVSS 9.8) that allows attackers to execute arbitrary commands through unsanitized terminal output.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25996?

Yes, a public proof-of-concept exploit is available for CVE-2026-25996. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-25996?

Within 24 hours: Identify all systems running Inspektor Gadget and assess exposure in your Kubernetes environment. Within 7 days: Apply the available vendor patch to all affected instances and validate functionality post-patch. Within 30 days: Conduct a security audit of cluster access logs to detect any exploitation attempts and review RBAC policies limiting Inspektor Gadget access to authorized personnel only.

Kubernetes CVE-2026-25996

EUVD-2026-6695 CRITICAL

Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)

2026-02-12 security-advisories@github.com

GHSA-34r5-6j7w-235f

Kubernetes Code Injection Inspektor Gadget Suse

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 16, 2026 - 18:02 vuln.today

Public exploit code

Patch released

Mar 16, 2026 - 18:02 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 12, 2026 - 21:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. Therefore, a maliciously forged - partially or completely - event payload, coming from an observed container, might inject the escape sequences into the terminal of ig operators, with various effects. The columns output mode is the default when running ig run interactively.

AnalysisAI

String filter bypass in Inspektor Gadget Kubernetes eBPF tooling before fix. Insufficient string escaping enables filter injection. PoC and patch available.